I try to get a regex which returns the match in the first capture group.
The Application where I put the regex in can only use the first capture Group.
Each regex on it’s own is working, but i can’t combine these two in a way that the output is always in the first capture group
Input 1:
Event: Started Flapping
Regex 1:
^Event: (\S+ Flapping)
Output 1:
Started Flapping
Input 2:
Event: CRIT -> OK
Regex 2:
^Event:\s+\S+\s+\S+\s+(\S+)
Ouput 2:
OK
The Regex i tried
(?:^Event:\s+\S+\s+\S+\s+(?P<service>\S+)$|^Event: (?P<flap>Started Flapping)|((?P=service)|(?P=flap)))
>Solution :
You can use a branch reset group:
^Event:\s+(?|\S+\s+\S+\s+(\S+)|(Started Flapping))$
# or, to factor in \S+\s+:
^Event:\s+(?|(?:\S+\s+){2}(\S+)|(Started Flapping))$
See the regex demo. Details:
^– start of stringEvent:– a fixed string\s+– one or more whitespaces(?|– start of a branch reset group:\S+\s+\S+\s+– two occurrences of one or more non-whitespaces followed with one or more whitespaces(\S+)– Group 1: one or more non-whitespaces
|– or(Started Flapping)– Group 1:Started Flappingfixed string
)– end of the branch reset group$– end of string.